Home › Forums › BlockHosts

Block IP of format nn.nn.nn.nn/nn with IPTABLES

Sat, 2010–Apr–10

I want to use some blocklists, contained in textfiles, which also block ranges of IPs.
For example, "file blocklist" contains lines like

123.12.0.0/16

I have already a regex for that, like

"blocklist_file":
r'^{HOST_IP}/\d\d?$',

but is there any way, that blockhosts will block 123.12.0.0./16, and not simply 123.12.0.0 ?

‹ AGE_THRESHOLD Regex for dovecot ›
Thu, 2010-04-15 08:47 — ac

requires code change

This requires a code change in the _do_iptables function.

For blocking, the following line:
cmd = path + " --append %s --source %s -j DROP" % (chain, host)
assuming iptables accepts the form /16, just add /16 after the --source %s in the string above.

But - this may impact the --list and other parts in that function - when it comes time to remove the block, not sure if it will find the correct ip and range to remove. So, this may need lot more work and testing.